CVE-2018-3620

Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access via a terminal page fault and a side-channel analysis.

Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access via a terminal page fault and a side-channel analysis.

Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access via a terminal page fault and a side-channel analysis.

This microcode update provides the Intel 20180807 microcode release that adds the processor microcode side of fixes and mitigations for the now publically known security issue affected Intel processors called L1 Terminal Fault (L1TF) for most Intel processors since Intel Core gen2:

Systems with microprocessors utilizing speculative execution and Intel Software Guard Extensions (Intel SGX) may allow unauthorized disclosure of information residing in the L1 data cache from an enclave to an attacker with local user access via side-channel analysis (CVE-2018-3615).

Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access via a terminal page fault and side-channel analysis (CVE-2018-3620).

Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and side-channel analysis (CVE-2018-3646).

The impact of the L1TF security issues:

• Malicious applications may be able to infer the values of data in the operating system memory, or data from other applications.
• A malicious guest virtual machine (VM) may be able to infer the values of data in the VMM’s memory, or values of data in the memory of other guest VMs.
• Malicious software running outside of SMM may be able to infer values of data in SMM memory.
• Malicious software running outside of an Intel® SGX enclave or within an enclave may be able to infer data from within another Intel SGX enclave.

NOTE! You also need to install one of the 4.14.65 based kernel updates to get the current operating system side set of fixes and mitigations for L1TF. That means either kernel (mga#23458), kernel-tmb (mga#23459) or kernel-linus (mga#23460).

For more detailed info about the microcode and a list of processors, see the referenced changelog.

This kernel update is based on the upstream 4.14.65 and adds fixes and mitigations for the now publically known security issue affecting Intel processors called L1 Terminal Fault (L1TF):

Systems with microprocessors utilizing speculative execution and Intel Software Guard Extensions (Intel SGX) may allow unauthorized disclosure of information residing in the L1 data cache from an enclave to an attacker with local user access via side-channel analysis (CVE-2018-3615).

Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access via a terminal page fault and side-channel analysis (CVE-2018-3620).

Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and side-channel analysis (CVE-2018-3646).

The impact of the L1TF security issues:

• Malicious applications may be able to infer the values of data in the operating system memory, or data from other applications.
• A malicious guest virtual machine (VM) may be able to infer the values of data in the VMM’s memory, or values of data in the memory of other guest VMs.
• Malicious software running outside of SMM may be able to infer values of data in SMM memory.
• Malicious software running outside of an Intel® SGX enclave or within an enclave may be able to infer data from within another Intel SGX enclave.

NOTE! You also need to install the 0.20180807-1.mga6.nonfree microcode update (mga#23457) or a bios update from your hardware vendor containing the updated microcodes to get all current set of fixes and mitigations for L1TF.

Other changes in this update:

• WireGuard has been updated to 0.0.20180809
• added hwmon support for Threadripper2

For other upstream fixes in this update, see the referenced changelogs.

This kernel-tmb update is based on the upstream 4.14.65 and adds fixes and mitigations for the now publically known security issue affecting Intel processors called L1 Terminal Fault (L1TF):

Systems with microprocessors utilizing speculative execution and Intel Software Guard Extensions (Intel SGX) may allow unauthorized disclosure of information residing in the L1 data cache from an enclave to an attacker with local user access via side-channel analysis (CVE-2018-3615).

Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access via a terminal page fault and side-channel analysis (CVE-2018-3620).

Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and side-channel analysis (CVE-2018-3646).

The impact of the L1TF security issues:

• Malicious applications may be able to infer the values of data in the operating system memory, or data from other applications.
• A malicious guest virtual machine (VM) may be able to infer the values of data in the VMM’s memory, or values of data in the memory of other guest VMs.
• Malicious software running outside of SMM may be able to infer values of data in SMM memory.
• Malicious software running outside of an Intel® SGX enclave or within an enclave may be able to infer data from within another Intel SGX enclave.

NOTE! You also need to install the 0.20180807-1.mga6.nonfree microcode update (mga#23457) or a bios update from your hardware vendor containing the updated microcodes to get all current set of fixes and mitigations for L1TF.

Other changes in this update:

• WireGuard has been updated to 0.0.20180809
• added hwmon support for Threadripper2

For other upstream fixes in this update, see the referenced changelogs.

This kernel-linus update is based on the upstream 4.14.65 and adds fixes and mitigations for the now publically known security issue affecting Intel processors called L1 Terminal Fault (L1TF):

Systems with microprocessors utilizing speculative execution and Intel Software Guard Extensions (Intel SGX) may allow unauthorized disclosure of information residing in the L1 data cache from an enclave to an attacker with local user access via side-channel analysis (CVE-2018-3615).

Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access via a terminal page fault and side-channel analysis (CVE-2018-3620).

Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and side-channel analysis (CVE-2018-3646).

The impact of the L1TF security issues:

• Malicious applications may be able to infer the values of data in the operating system memory, or data from other applications.
• A malicious guest virtual machine (VM) may be able to infer the values of data in the VMM’s memory, or values of data in the memory of other guest VMs.
• Malicious software running outside of SMM may be able to infer values of data in SMM memory.
• Malicious software running outside of an Intel® SGX enclave or within an enclave may be able to infer data from within another Intel SGX enclave.

NOTE! You also need to install the 0.20180807-1.mga6.nonfree microcode update (mga#23457) or a bios update from your hardware vendor containing the updated microcodes to get all current set of fixes and mitigations for L1TF.

For other upstream fixes in this update, see the referenced changelogs.

These are all security issues fixed in the spectre-meltdown-checker-26.36.0602723-1.1 package on the GA media of openSUSE Tumbleweed.

The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.143 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-5390 aka 'SegmentSmack': Linux kernel could be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (bnc#1102340).
• CVE-2018-14734: drivers/infiniband/core/ucma.c in the Linux kernel allowed ucma_leave_multicast to access a certain data structure after a cleanup step in ucma_process_join, which allowed attackers to cause a denial of service (use-after-free) (bnc#1103119).
• CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers.c didn't properly validate the sigevent->sigev_notify field, which lead to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allowed userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE) (bnc#1102851 bnc#1103580).
• CVE-2018-3620: Local attackers on baremetal systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data. (bnc#1087081).
• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system. (bnc#1089343).

The following non-security bugs were fixed:

• Add support for 5,25,50, and 100G to 802.3ad bonding driver (bsc#1096978)
• ahci: Disable LPM on Lenovo 50 series laptops with a too old BIOS (bnc#1012382).
• arm64: do not open code page table entry creation (bsc#1102197).
• arm64: kpti: Use early_param for kpti= command-line option (bsc#1102188).
• arm64: Make sure permission updates happen for pmd/pud (bsc#1102197).
• atm: zatm: Fix potential Spectre v1 (bnc#1012382).
• bcm63xx_enet: correct clock usage (bnc#1012382).
• bcm63xx_enet: do not write to random DMA channel on BCM6345 (bnc#1012382).
• blacklist 9fb8d5dc4b64 ('stop_machine: Disable preemption when waking two stopper threads') Preemption is already disabled inside cpu_stop_queue_two_works() in SLE12-SP3 because it does not have commit 6a19005157c4 ('stop_machine: Do not disable preemption in stop_two_cpus()')
• block: copy ioprio in __bio_clone_fast() (bsc#1082653).
• bpf: fix loading of BPF_MAXINSNS sized programs (bsc#1012382).
• bpf, x64: fix memleak when not converging after image (bsc#1012382).
• cachefiles: Fix missing clear of the CACHEFILES_OBJECT_ACTIVE flag (bsc#1099858).
• cachefiles: Fix refcounting bug in backing-file read monitoring (bsc#1099858).
• cachefiles: Wait rather than BUG'ing on 'Unexpected object collision' (bsc#1099858).
• cifs: fix bad/NULL ptr dereferencing in SMB2_sess_setup() (bsc#1090123).
• compiler, clang: always inline when CONFIG_OPTIMIZE_INLINING is disabled (bnc#1012382).
• compiler, clang: properly override 'inline' for clang (bnc#1012382).
• compiler, clang: suppress warning for unused static inline functions (bnc#1012382).
• compiler-gcc.h: Add attribute((gnu_inline)) to all inline declarations (bnc#1012382).
• cpu/hotplug: Add sysfs state interface (bsc#1089343).
• cpu/hotplug: Provide knobs to control SMT (bsc#1089343).
• cpu/hotplug: Split do_cpu_down() (bsc#1089343).
• crypto: crypto4xx - fix crypto4xx_build_pdr, crypto4xx_build_sdr leak (bnc#1012382).
• crypto: crypto4xx - remove bad list_del (bnc#1012382).
• drm/msm: Fix possible null dereference on failure of get_pages() (bsc#1102394).
• drm: re-enable error handling (bsc#1103884).
• fscache: Allow cancelled operations to be enqueued (bsc#1099858).
• fscache: Fix reference overput in fscache_attach_object() error handling (bsc#1099858).
• hid: usbhid: add quirk…

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-3620: Local attackers on baremetal systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data. (bnc#1087081).
• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system. (bnc#1089343).
• CVE-2018-1000204: A malformed SG_IO ioctl issued for a SCSI device could lead to a local kernel information leak manifesting in up to approximately 1000 memory pages copied to the userspace. The problem has limited scope as non-privileged users usually have no permissions to access SCSI device files. (bnc#1096728).
• CVE-2018-13053: The alarm_timer_nsleep function in kernel/time/alarmtimer.c had an integer overflow via a large relative timeout because ktime_add_safe is not used (bnc#1099924).
• CVE-2018-13406: An integer overflow in the uvesafb_setcmap function in drivers/video/fbdev/uvesafb.c could result in local attackers being able to crash the kernel or potentially elevate privileges because kmalloc_array is not used (bnc#1098016 bnc#1100418).
• CVE-2016-8405: An information disclosure vulnerability in kernel components including the ION subsystem, Binder, USB driver and networking subsystem could enable a local malicious application to access data outside of its permission levels. (bnc#1099942).
• CVE-2018-5814: Multiple race condition errors when handling probe, disconnect, and rebind operations could be exploited to trigger a use-after-free condition or a NULL pointer dereference by sending multiple USB over IP packets (bnc#1096480).
• CVE-2018-12233: In the ea_get function in fs/jfs/xattr.c a memory corruption bug in JFS can be triggered by calling setxattr twice with two different extended attribute names on the same file. This vulnerability can be triggered by an unprivileged user with the ability to create files and execute programs. (bnc#1097234).
• CVE-2017-13305: A information disclosure vulnerability in the Upstream kernel encrypted-keys. (bnc#1094353).
• CVE-2018-1130: A null pointer dereference in dccp_write_xmit() function in net/dccp/output.c allowed a local user to cause a denial of service by a number of certain crafted system calls (bnc#1092904).
• CVE-2018-1068: A flaw was found in the implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory (bnc#1085107).
• CVE-2018-5803: An error in the '_sctp_make_chunk()' function (net/sctp/sm_make_chunk.c) when handling SCTP packets length could be exploited to cause a kernel crash (bnc#1083900).
• CVE-2018-7492: A NULL pointer dereference was found in the net/rds/rdma.c __rds_rdma_map() function allowed local attackers to cause a system panic and a denial-of-service, related to RDS_GET_MR and RDS_GET_MR_FOR_DEST (bnc#1082962).

The following non-security bugs were fixed:

• cpu/hotplug: Add sysfs state interface (bsc#1089343).
• cpu/hotplug: Provide knobs to control SMT (bsc#1089343).
• cpu/hotplug: Split do_cpu_down() (bsc#1089343).
• disable-prot_none_mitigation.patch: disable prot_none native mitigation (bnc#1104684)
• fix pgd underflow (bnc#1104475) custom walk_page_range rework was incorrect and could underflow pgd if the given range was below a first vma.
• slab: introduce kmalloc_array() (bsc#909361).
• x86/apic: Ignore secondary threads if nosmt=force (bsc#1089343).
• x86/cpu/AMD: Do not check CPUID max ext level before parsing SMP info (bsc#1089343).
• x86/cpu/AMD: Evaluate smp_num_siblings early (bsc#1089343).
• x86/cpu/AMD: Move TOPOEXT reenablement before…

The SUSE Linux Enterprise 12 SP2 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-3620: Local attackers on baremetal systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data. (bnc#1087081).
• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system. (bnc#1089343).
• CVE-2018-5390 aka 'SegmentSmack': The Linux Kernel can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (bnc#1102340).
• CVE-2018-5391 aka 'FragmentSmack': A flaw in the IP packet reassembly could be used by remote attackers to consume lots of CPU time (bnc#1103097).
• CVE-2018-14734: drivers/infiniband/core/ucma.c allowed ucma_leave_multicast to access a certain data structure after a cleanup step in ucma_process_join, which allowed attackers to cause a denial of service (use-after-free) (bnc#1103119).
• CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers.c didn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allowed userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE) (bnc#1102851 bnc#1103580).
• CVE-2018-9385: When printing the 'driver_override' option from with-in the amba driver, a very long line could expose one additional uninitialized byte (bnc#1100491).
• CVE-2018-13053: The alarm_timer_nsleep function in kernel/time/alarmtimer.c had an integer overflow via a large relative timeout because ktime_add_safe is not used (bnc#1099924).
• CVE-2018-13405: The inode_init_owner function in fs/inode.c allowed local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID (bnc#1100416).
• CVE-2018-13406: An integer overflow in the uvesafb_setcmap function in drivers/video/fbdev/uvesafb.c could result in local attackers being able to crash the kernel or potentially elevate privileges because kmalloc_array is not used (bnc#1098016 1100418).
• CVE-2018-5814: Multiple race condition errors when handling probe, disconnect, and rebind operations could be exploited to trigger a use-after-free condition or a NULL pointer dereference by sending multiple USB over IP packets (bnc#1096480).

The following non-security bugs were fixed:

• Add support for 5,25,50, and 100G to 802.3ad bonding driver (bsc#1096978)
• bcache: add backing_request_endio() for bi_end_io (bsc#1064232).
• bcache: add CACHE_SET_IO_DISABLE to struct cache_set flags (bsc#1064232).
• bcache: add io_disable to struct cached_dev (bsc#1064232).
• bcache: add journal statistic (bsc#1076110).
• bcache: Add __printf annotation to __bch_check_keys() (bsc#1064232).
• bcache: add stop_when_cache_set_failed option to backing device (bsc#1064232).
• bcache: add wait_for_kthread_stop() in bch_allocator_thread() (bsc#1064232).
• bcache: Annotate switch fall-through (bsc#1064232).
• bcache: closures: move control bits one bit right (bsc#1076110).
• bcache: correct flash only vols (check all uuids) (bsc#1064232). -…

The SUSE Linux Enterprise 12 SP2 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-3620: Local attackers on baremetal systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data. (bnc#1087081).
• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system. (bnc#1089343).
• CVE-2018-5390 aka 'SegmentSmack': The Linux Kernel can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (bnc#1102340).
• CVE-2018-5391 aka 'FragmentSmack': A flaw in the IP packet reassembly could be used by remote attackers to consume lots of CPU time (bnc#1103097).
• CVE-2018-14734: drivers/infiniband/core/ucma.c allowed ucma_leave_multicast to access a certain data structure after a cleanup step in ucma_process_join, which allowed attackers to cause a denial of service (use-after-free) (bnc#1103119).
• CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers.c didn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allowed userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE) (bnc#1102851 bnc#1103580).
• CVE-2018-9385: When printing the 'driver_override' option from with-in the amba driver, a very long line could expose one additional uninitialized byte (bnc#1100491).
• CVE-2018-13053: The alarm_timer_nsleep function in kernel/time/alarmtimer.c had an integer overflow via a large relative timeout because ktime_add_safe is not used (bnc#1099924).
• CVE-2018-13405: The inode_init_owner function in fs/inode.c allowed local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID (bnc#1100416).
• CVE-2018-13406: An integer overflow in the uvesafb_setcmap function in drivers/video/fbdev/uvesafb.c could result in local attackers being able to crash the kernel or potentially elevate privileges because kmalloc_array is not used (bnc#1098016 1100418).
• CVE-2018-5814: Multiple race condition errors when handling probe, disconnect, and rebind operations could be exploited to trigger a use-after-free condition or a NULL pointer dereference by sending multiple USB over IP packets (bnc#1096480).

The following non-security bugs were fixed:

• Add support for 5,25,50, and 100G to 802.3ad bonding driver (bsc#1096978)
• bcache: add backing_request_endio() for bi_end_io (bsc#1064232).
• bcache: add CACHE_SET_IO_DISABLE to struct cache_set flags (bsc#1064232).
• bcache: add io_disable to struct cached_dev (bsc#1064232).
• bcache: add journal statistic (bsc#1076110).
• bcache: Add __printf annotation to __bch_check_keys() (bsc#1064232).
• bcache: add stop_when_cache_set_failed option to backing device (bsc#1064232).
• bcache: add wait_for_kthread_stop() in bch_allocator_thread() (bsc#1064232).
• bcache: Annotate switch fall-through (bsc#1064232).
• bcache: closures: move control bits one bit right (bsc#1076110).
• bcache: correct flash only vols (check all uuids) (bsc#1064232). -…

The SUSE Linux Enterprise 12 GA LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-13053: The alarm_timer_nsleep function in kernel/time/alarmtimer.c had an integer overflow via a large relative timeout because ktime_add_safe is not used (bnc#1099924).
• CVE-2018-13405: The inode_init_owner function in fs/inode.c allowed local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID (bnc#1100416).
• CVE-2018-13406: An integer overflow in the uvesafb_setcmap function in drivers/video/fbdev/uvesafb.c could result in local attackers being able to crash the kernel or potentially elevate privileges because kmalloc_array is not used (bnc#1098016 bnc#1100418).
• CVE-2018-14734: drivers/infiniband/core/ucma.c allowed ucma_leave_multicast to access a certain data structure after a cleanup step in ucma_process_join, which allowed attackers to cause a denial of service (use-after-free) (bnc#1103119).
• CVE-2018-3620: Local attackers on baremetal systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data. (bnc#1087081).
• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system. (bnc#1089343).

The following non-security bugs were fixed:

• bcache: Add __printf annotation to __bch_check_keys() (bsc#1064232).
• bcache: Annotate switch fall-through (bsc#1064232).
• bcache: Fix a compiler warning in bcache_device_init() (bsc#1064232).
• bcache: Fix indentation (bsc#1064232).
• bcache: Fix kernel-doc warnings (bsc#1064232).
• bcache: Fix, improve efficiency of closure_sync() (bsc#1064232).
• bcache: Reduce the number of sparse complaints about lock imbalances (bsc#1064232).
• bcache: Remove an unused variable (bsc#1064232).
• bcache: Suppress more warnings about set-but-not-used variables (bsc#1064232).
• bcache: Use PTR_ERR_OR_ZERO() (bsc#1064232).
• bcache: add CACHE_SET_IO_DISABLE to struct cache_set flags (bsc#1064232).
• bcache: add backing_request_endio() for bi_end_io (bsc#1064232).
• bcache: add io_disable to struct cached_dev (bsc#1064232).
• bcache: add journal statistic (bsc#1064232).
• bcache: add stop_when_cache_set_failed option to backing device (bsc#1064232).
• bcache: add wait_for_kthread_stop() in bch_allocator_thread() (bsc#1064232).
• bcache: closures: move control bits one bit right (bsc#1064232).
• bcache: correct flash only vols (check all uuids) (bsc#1064232).
• bcache: count backing device I/O error for writeback I/O (bsc#1064232).
• bcache: do not attach backing with duplicate UUID (bsc#1064232).
• bcache: fix cached_dev->count usage for bch_cache_set_error() (bsc#1064232).
• bcache: fix crashes in duplicate cache device register (bsc#1064232).
• bcache: fix error return value in memory shrink (bsc#1064232).
• bcache: fix for allocator and register thread race (bsc#1064232).
• bcache: fix for data collapse after re-attaching an attached device (bsc#1064232).
• bcache: fix high CPU occupancy during journal (bsc#1064232).
• bcache: fix incorrect sysfs output value of strip size (bsc#1064232).
• bcache: fix kcrashes with fio in RAID5 backend dev (bsc#1064232).
• bcache: fix misleading error message in bch_count_io_errors() (bsc#1064232). -…

The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2016-8405: An information disclosure vulnerability in kernel components including the ION subsystem, Binder, USB driver and networking subsystem could enable a local malicious application to access data outside of its permission levels. (bnc#1099942).
• CVE-2017-13305: A information disclosure vulnerability existed in the encrypted-keys handling. (bnc#1094353).
• CVE-2018-1000204: A malformed SG_IO ioctl issued for a SCSI device could lead to a local kernel information leak manifesting in up to approximately 1000 memory pages copied to the userspace. The problem has limited scope as non-privileged users usually have no permissions to access SCSI device files. (bnc#1096728).
• CVE-2018-1068: A flaw was found in the implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory (bnc#1085107).
• CVE-2018-1130: A null pointer dereference in dccp_write_xmit() function in net/dccp/output.c allowed a local user to cause a denial of service by a number of certain crafted system calls (bnc#1092904).
• CVE-2018-12233: In the ea_get function in fs/jfs/xattr.c a memory corruption bug in JFS can be triggered by calling setxattr twice with two different extended attribute names on the same file. This vulnerability can be triggered by an unprivileged user with the ability to create files and execute programs. A kmalloc call is incorrect, leading to slab-out-of-bounds in jfs_xattr (bnc#1097234).
• CVE-2018-13053: The alarm_timer_nsleep function in kernel/time/alarmtimer.c had an integer overflow via a large relative timeout because ktime_add_safe is not used (bnc#1099924).
• CVE-2018-13406: An integer overflow in the uvesafb_setcmap function in drivers/video/fbdev/uvesafb.c kernel could result in local attackers being able to crash the kernel or potentially elevate privileges because kmalloc_array is not used (bnc#1098016 1100418).
• CVE-2018-3620: Local attackers on baremetal systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data. (bnc#1087081).
• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system. (bnc#1089343).
• CVE-2018-5803: An error in the '_sctp_make_chunk()' function (net/sctp/sm_make_chunk.c) when handling SCTP packets length could be exploited to cause a kernel crash (bnc#1083900).
• CVE-2018-5814: Multiple race condition errors when handling probe, disconnect, and rebind operations could be exploited to trigger a use-after-free condition or a NULL pointer dereference by sending multiple USB over IP packets (bnc#1096480).
• CVE-2018-7492: A NULL pointer dereference was found in the net/rds/rdma.c __rds_rdma_map() function allowing local attackers to cause a system panic and a denial-of-service, related to RDS_GET_MR and RDS_GET_MR_FOR_DEST (bnc#1082962).

The following non-security bugs were fixed:

• cpu/hotplug: Add sysfs state interface (bsc#1089343).
• cpu/hotplug: Provide knobs to control SMT (bsc#1089343).
• cpu/hotplug: Provide knobs to control SMT (bsc#1089343).
• cpu/hotplug: Split do_cpu_down() (bsc#1089343).
• disable-prot_none_mitigation.patch: disable prot_none native mitigation (bnc#1104684)
• fix pgd underflow (bnc#1104475) custom walk_page_range rework was incorrect and could underflow pgd if the given range was below a first vma.
• slab: introduce kmalloc_array() (bsc#909361).
• x86/apic: Ignore secondary threads if nosmt=force (bsc#1089343).
• x86/CPU/AMD: Do not check CPUID max ext level before…

The SUSE Linux Enterprise 12 SP3 Azure kernel was updated to 4.4.143 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-3620: Local attackers on baremetal systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data. (bnc#1087081).
• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system. (bnc#1089343).
• CVE-2018-5391: A flaw in the IP packet reassembly could be used by remote attackers to consume CPU time (bnc#1103097).
• CVE-2018-5390: Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (bnc#1102340).
• CVE-2018-14734: drivers/infiniband/core/ucma.c allowed ucma_leave_multicast to access a certain data structure after a cleanup step in ucma_process_join, which allowed attackers to cause a denial of service (use-after-free) (bnc#1103119).
• CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers.c didn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allowed userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE) (bnc#1102851 1103580).

The following non-security bugs were fixed:

• 1wire: family module autoload fails because of upper/lower case mismatch (bnc#1012382).
• Add support for 5,25,50, and 100G to 802.3ad bonding driver (bsc#1096978)
• ahci: Disable LPM on Lenovo 50 series laptops with a too old BIOS (bnc#1012382).
• alsa: hda - Fix pincfg at resume on Lenovo T470 dock (bsc#1099810).
• alsa: hda - Handle kzalloc() failure in snd_hda_attach_pcm_stream() (bnc#1012382).
• alsa: hda/realtek - set PINCFG_HEADSET_MIC to parse_flags (bsc#1099810).
• arm64: do not open code page table entry creation (bsc#1102197).
• arm64: kpti: Use early_param for kpti= command-line option (bsc#1102188).
• arm64: Make sure permission updates happen for pmd/pud (bsc#1102197).
• arm: 8764/1: kgdb: fix NUMREGBYTES so that gdb_regs[] is the correct size (bnc#1012382).
• arm: dts: imx6q: Use correct SDMA script for SPI5 core (bnc#1012382).
• ASoC: cirrus: i2s: Fix LRCLK configuration (bnc#1012382).
• ASoC: cirrus: i2s: Fix {TX|RX}LinCtrlData setup (bnc#1012382).
• ASoC: dapm: delete dapm_kcontrol_data paths list before freeing it (bnc#1012382).
• ath10k: fix rfc1042 header retrieval in QCA4019 with eth decap mode (bnc#1012382).
• atm: zatm: fix memcmp casting (bnc#1012382).
• atm: zatm: Fix potential Spectre v1 (bnc#1012382).
• backlight: as3711_bl: Fix Device Tree node lookup (bnc#1012382).
• backlight: max8925_bl: Fix Device Tree node lookup (bnc#1012382).
• backlight: tps65217_bl: Fix Device Tree node lookup (bnc#1012382).
• bcache: add backing_request_endio() for bi_end_io (bsc#1064232).
• bcache: add CACHE_SET_IO_DISABLE to struct cache_set flags (bsc#1064232).
• bcache: add io_disable to struct cached_dev (bsc#1064232).
• bcache: add journal statistic (bsc#1076110).
• bcache: Add __printf annotation to __bch_check_keys() (bsc#1064232).
• bcache: add stop_when_cache_set_failed option to backing device (bsc#1064232).
• bcache: add wait_for_kthread_stop() in bch_allocator_thread() (bsc#1064232).
• bcache: Annotate switch fall-through (bsc#1064232).
• bcache: closures: move control bits one bit right (bsc#1076110).
• bcache: correct flash only vols (check all uuids) (bsc#1064232).
• bcache: count backing device I/O error for writeback I/O (bsc#1064232).
• bcache: Fix a…

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-3620: Local attackers on baremetal systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data. (bnc#1087081).
• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system. (bnc#1089343).
• CVE-2018-5391 aka 'FragmentSmack': A flaw in the IP packet reassembly could be used by remote attackers to consume lots of CPU time (bnc#1103097).
• CVE-2018-10876: A flaw was found in the ext4 filesystem code. A use-after-free is possible in ext4_ext_remove_space() function when mounting and operating a crafted ext4 image. (bnc#1099811)
• CVE-2018-10877: The ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image. (bnc#1099846)
• CVE-2018-10878: A flaw was found in the ext4 filesystem. A local user can cause an out-of-bounds write and a denial of service or unspecified other impact is possible by mounting and operating a crafted ext4 filesystem image. (bnc#1099813)
• CVE-2018-10879: A flaw was found in the ext4 filesystem. A local user can cause a use-after-free in ext4_xattr_set_entry function and a denial of service or unspecified other impact may occur by renaming a file in a crafted ext4 filesystem image. (bnc#1099844)
• CVE-2018-10880: Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in ext4_update_inline_data(). An attacker could use this to cause a system crash and a denial of service. (bnc#1099845)
• CVE-2018-10881: A flaw was found in the ext4 filesystem. A local user can cause an out-of-bound access in ext4_get_group_info function, a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image. (bnc#1099864)
• CVE-2018-10882: A flaw was found in the ext4 filesystem. A local user can cause an out-of-bound write in in fs/jbd2/transaction.c code, a denial of service, and a system crash by unmounting a crafted ext4 filesystem image. (bnc#1099849)
• CVE-2018-10883: A flaw was found in the ext4 filesystem. A local user can cause an out-of-bounds write in jbd2_journal_dirty_metadata(), a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image. (bnc#1099863)

The following non-security bugs were fixed:

• acpi / lpss: Only call pwm_add_table() for Bay Trail PWM if PMIC HRV is 2 (bsc#1051510).
• af_key: Always verify length of provided sadb_key (bsc#1051510).
• af_key: fix buffer overread in parse_exthdrs() (bsc#1051510).
• af_key: fix buffer overread in verify_address_len() (bsc#1051510).
• afs: Fix directory permissions check (bsc#1101828).
• agp: uninorth: make two functions static (bsc#1051510).
• alsa: emu10k1: add error handling for snd_ctl_add (bsc#1051510).
• alsa: emu10k1: Rate-limit error messages about page errors (bsc#1051510).
• alsa: fm801: add error handling for snd_ctl_add (bsc#1051510).
• alsa: usb-audio: Apply rate limit to warning messages in URB complete callback (bsc#1051510).
• arm64: Correct type for PUD macros (bsc#1103723).
• arm64: Disable unhandled signal log messages by default (bsc#1103724).
• arm64: kvm: fix VTTBR_BADDR_MASK BUG_ON off-by-one (bsc#1103725).
• arm64: mm: Fix set_memory_valid() declaration (bsc#1103726).
• arm64: perf: correct PMUVer probing (bsc#1103727).
• arm64: ptrace: Avoid setting compat FPR to garbage if get_user fails (bsc#1103728).
• arm64: spinlock: Fix theoretical trylock() A-B-A with LSE atomics (bsc#1103729). -…

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-3620: Local attackers on baremetal systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data. (bnc#1087081).
• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system. (bnc#1089343).
• CVE-2018-5391 aka 'FragmentSmack': A flaw in the IP packet reassembly could be used by remote attackers to consume lots of CPU time (bnc#1103097).
• CVE-2018-10876: A flaw was found in the ext4 filesystem code. A use-after-free is possible in ext4_ext_remove_space() function when mounting and operating a crafted ext4 image. (bnc#1099811)
• CVE-2018-10877: The ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image. (bnc#1099846)
• CVE-2018-10878: A flaw was found in the ext4 filesystem. A local user can cause an out-of-bounds write and a denial of service or unspecified other impact is possible by mounting and operating a crafted ext4 filesystem image. (bnc#1099813)
• CVE-2018-10879: A flaw was found in the ext4 filesystem. A local user can cause a use-after-free in ext4_xattr_set_entry function and a denial of service or unspecified other impact may occur by renaming a file in a crafted ext4 filesystem image. (bnc#1099844)
• CVE-2018-10880: Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in ext4_update_inline_data(). An attacker could use this to cause a system crash and a denial of service. (bnc#1099845)
• CVE-2018-10881: A flaw was found in the ext4 filesystem. A local user can cause an out-of-bound access in ext4_get_group_info function, a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image. (bnc#1099864)
• CVE-2018-10882: A flaw was found in the ext4 filesystem. A local user can cause an out-of-bound write in in fs/jbd2/transaction.c code, a denial of service, and a system crash by unmounting a crafted ext4 filesystem image. (bnc#1099849)
• CVE-2018-10883: A flaw was found in the ext4 filesystem. A local user can cause an out-of-bounds write in jbd2_journal_dirty_metadata(), a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image. (bnc#1099863)

The following non-security bugs were fixed:

• acpi / lpss: Only call pwm_add_table() for Bay Trail PWM if PMIC HRV is 2 (bsc#1051510).
• af_key: Always verify length of provided sadb_key (bsc#1051510).
• af_key: fix buffer overread in parse_exthdrs() (bsc#1051510).
• af_key: fix buffer overread in verify_address_len() (bsc#1051510).
• afs: Fix directory permissions check (bsc#1101828).
• agp: uninorth: make two functions static (bsc#1051510).
• alsa: emu10k1: add error handling for snd_ctl_add (bsc#1051510).
• alsa: emu10k1: Rate-limit error messages about page errors (bsc#1051510).
• alsa: fm801: add error handling for snd_ctl_add (bsc#1051510).
• alsa: usb-audio: Apply rate limit to warning messages in URB complete callback (bsc#1051510).
• arm64: Correct type for PUD macros (bsc#1103723).
• arm64: Disable unhandled signal log messages by default (bsc#1103724).
• arm64: kvm: fix VTTBR_BADDR_MASK BUG_ON off-by-one (bsc#1103725).
• arm64: mm: Fix set_memory_valid() declaration (bsc#1103726).
• arm64: perf: correct PMUVer probing (bsc#1103727).
• arm64: ptrace: Avoid setting compat FPR to garbage if get_user fails (bsc#1103728).
• arm64: spinlock: Fix theoretical trylock() A-B-A with LSE atomics (bsc#1103729). -…

The SUSE Linux Enterprise 12 SP1 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-3620: Local attackers on baremetal systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data. (bnc#1087081).
• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system. (bnc#1089343).
• CVE-2018-14734: drivers/infiniband/core/ucma.c allowed ucma_leave_multicast to access a certain data structure after a cleanup step in ucma_process_join, which allowed attackers to cause a denial of service (use-after-free) (bnc#1103119).
• CVE-2018-13053: The alarm_timer_nsleep function in kernel/time/alarmtimer.c had via a large relative timeout because ktime_add_safe is not used (bnc#1099924).
• CVE-2018-13405: The inode_init_owner function in fs/inode.c allowed local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID (bnc#1100416).
• CVE-2018-13406: An integer overflow in the uvesafb_setcmap function in drivers/video/fbdev/uvesafb.c could result in local attackers being able to crash the kernel or potentially elevate privileges because kmalloc_array is not used (bnc#1098016 bnc#1100418).

The following non-security bugs were fixed:

• bcache: add backing_request_endio() for bi_end_io (bsc#1064233).
• bcache: add CACHE_SET_IO_DISABLE to struct cache_set flags (bsc#1064233).
• bcache: add io_disable to struct cached_dev (bsc#1064233).
• bcache: add journal statistic (bsc#1076110).
• bcache: Add __printf annotation to __bch_check_keys() (bsc#1076110).
• bcache: add stop_when_cache_set_failed option to backing device (bsc#1064233).
• bcache: add wait_for_kthread_stop() in bch_allocator_thread() (bsc#1064233).
• bcache: Annotate switch fall-through (bsc#1076110).
• bcache: closures: move control bits one bit right (bsc#1076110).
• bcache: correct flash only vols (check all uuids) (bsc#1064233).
• bcache: count backing device I/O error for writeback I/O (bsc#1064233).
• bcache: do not attach backing with duplicate UUID (bsc#1076110).
• bcache: Fix a compiler warning in bcache_device_init() (bsc#1076110).
• bcache: fix cached_dev->count usage for bch_cache_set_error() (bsc#1064233).
• bcache: fix crashes in duplicate cache device register (bsc#1076110).
• bcache: fix error return value in memory shrink (bsc#1076110).
• bcache: fix for allocator and register thread race (bsc#1076110).
• bcache: fix for data collapse after re-attaching an attached device (bsc#1076110).
• bcache: fix high CPU occupancy during journal (bsc#1076110).
• bcache: Fix, improve efficiency of closure_sync() (bsc#1076110).
• bcache: fix incorrect sysfs output value of strip size (bsc#1076110).
• bcache: Fix indentation (bsc#1076110).
• bcache: fix kcrashes with fio in RAID5 backend dev (bsc#1076110).
• bcache: Fix kernel-doc warnings (bsc#1076110).
• bcache: fix misleading error message in bch_count_io_errors() (bsc#1064233).
• bcache: fix using of loop variable in memory shrink (bsc#1076110).
• bcache: fix writeback target calc on large devices (bsc#1076110).
• bcache: fix wrong return value in bch_debug_init() (bsc#1076110).
• bcache: mark closure_sync() __sched (bsc#1076110).
• bcache: move closure debug…

The SUSE Linux Enterprise 15 azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-5391: A remote attacker even with relatively low bandwidth could have caused lots of CPU usage by triggering the worst case scenario during fragment reassembly (bsc#1103097)
• CVE-2018-3620, CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system. (bnc#1089343, bsc#1087081).
• CVE-2018-10882: A local user could have caused an out-of-bound write, leading to denial of service and a system crash by unmounting a crafted ext4 filesystem image (bsc#1099849).
• CVE-2018-10880: Prevent a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing crafted ext4 images. An attacker could have used this to cause a system crash and a denial of service (bsc#1099845).
• CVE-2018-10881: A local user could have caused an out-of-bound access and a system crash by mounting and operating on a crafted ext4 filesystem image (bsc#1099864).
• CVE-2018-10877: Prevent an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image (bsc#1099846).
• CVE-2018-10876: Prevent use-after-free in ext4_ext_remove_space() function when mounting and operating a crafted ext4 image (bsc#1099811).
• CVE-2018-10878: A local user could have caused an out-of-bounds write and a denial of service by mounting and operating a crafted ext4 filesystem image (bsc#1099813).
• CVE-2018-10883: A local user could have caused an out-of-bounds write in jbd2_journal_dirty_metadata(), a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image (bsc#1099863).
• CVE-2018-10879: A local user could have caused a use-after-free in ext4_xattr_set_entry function and a denial of service or unspecified other impact may occur by renaming a file in a crafted ext4 filesystem image (bsc#1099844).
• CVE-2018-10853: A flaw was found in Linux Kernel KVM. In which certain instructions such as sgdt/sidt call segmented_write_std doesn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bnc#1097104).

The following non-security bugs were fixed:

• apci / lpss: Only call pwm_add_table() for Bay Trail PWM if PMIC HRV is 2 (bsc#1051510).
• acpi / pci: Bail early in acpi_pci_add_bus() if there is no ACPI handle (bsc#1051510).
• af_key: Always verify length of provided sadb_key (bsc#1051510).
• af_key: fix buffer overread in parse_exthdrs() (bsc#1051510).
• af_key: fix buffer overread in verify_address_len() (bsc#1051510).
• afs: Fix directory permissions check (bsc#1101828).
• agp: uninorth: make two functions static (bsc#1051510).
• alsa: emu10k1: add error handling for snd_ctl_add (bsc#1051510).
• alsa: emu10k1: Rate-limit error messages about page errors (bsc#1051510).
• alsa: fm801: add error handling for snd_ctl_add (bsc#1051510).
• alsa: snd-aoa: add of_node_put() in error path (bsc#1051510).
• alsa: usb-audio: Apply rate limit to warning messages in URB complete callback (bsc#1051510).
• arm64: Correct type for PUD macros (bsc#1103723).
• arm64: Disable unhandled signal log messages by default (bsc#1103724).
• arm64: KVM: fix VTTBR_BADDR_MASK BUG_ON off-by-one (bsc#1103725).
• arm64: mm: Fix set_memory_valid() declaration (bsc#1103726).
• arm64: perf: correct PMUVer probing (bsc#1103727).
• arm64: ptrace: Avoid setting compat FPR to garbage if get_user fails (bsc#1103728).
• arm64: spinlock: Fix theoretical trylock() A-B-A with LSE atomics (bsc#1103729).
• arm64: vdso: fix clock_getres for 4GiB-aligned res (bsc#1103730).
• arm: 8715/1: add a…

The SUSE Linux Enterprise 12 SP3 RT kernel was updated to 4.4.147 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers.c didn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allowed userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE) (bnc#1102851 bsc#1103580).
• CVE-2018-10876: A flaw was found in the ext4 filesystem code. A use-after-free was possible in ext4_ext_remove_space() function when mounting and operating a crafted ext4 image. (bnc#1099811)
• CVE-2018-10877: The ext4 filesystem was vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image. (bnc#1099846)
• CVE-2018-10878: A flaw was found in the ext4 filesystem. A local user could cause an out-of-bounds write and a denial of service or unspecified other impact is possible by mounting and operating a crafted ext4 filesystem image. (bnc#1099813)
• CVE-2018-10879: A flaw was found in the ext4 filesystem. A local user could cause a use-after-free in ext4_xattr_set_entry function and a denial of service or unspecified other impact may occur by renaming a file in a crafted ext4 filesystem image. (bnc#1099844)
• CVE-2018-10880: Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in ext4_update_inline_data(). An attacker could use this to cause a system crash and a denial of service. (bnc#1099845)
• CVE-2018-10881: A flaw was found in the ext4 filesystem. A local user can cause an out-of-bound access in ext4_get_group_info function, a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image. (bnc#1099864)
• CVE-2018-10882: A flaw was found in the ext4 filesystem. A local user can cause an out-of-bound write in in fs/jbd2/transaction.c code, a denial of service, and a system crash by unmounting a crafted ext4 filesystem image. (bnc#1099849)
• CVE-2018-10883: A flaw was found in the ext4 filesystem. A local user can cause an out-of-bounds write in jbd2_journal_dirty_metadata(), a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image. (bnc#1099863)
• CVE-2018-14734: drivers/infiniband/core/ucma.c allowed ucma_leave_multicast to access a certain data structure after a cleanup step in ucma_process_join, which allowed attackers to cause a denial of service (use-after-free) (bnc#1103119).
• CVE-2018-3620: Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access via a terminal page fault and a side-channel analysis (bnc#1087081).
• CVE-2018-3646: Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis (bnc#1089343 bnc#1104365).
• CVE-2018-5390: The Linux kernel could be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (bnc#1102340).
• CVE-2018-5391 aka 'FragmentSmack': A flaw in the IP packet reassembly could be used by remote attackers to consume lots of CPU time (bnc#1103097).
• CVE-2018-9363: A buffer overflow in bluetooth HID report processing could be used by malicious bluetooth devices to crash the kernel or potentially execute code (bnc#1105292).

The following non-security bugs were fixed:

• acpi / pci: Bail early in acpi_pci_add_bus() if there is no ACPI handle…

The SUSE Linux Enterprise 11 SP4 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2016-8405: An information disclosure vulnerability in kernel components including the ION subsystem, Binder, USB driver and networking subsystem could enable a local malicious application to access data outside of its permission levels. (bnc#1099942).
• CVE-2017-13305: A information disclosure vulnerability was fixed in the encrypted-keys handling. (bnc#1094353).
• CVE-2018-1000204: A malformed SG_IO ioctl issued for a SCSI device lead to a local kernel data leak manifesting in up to approximately 1000 memory pages copied to the userspace. The problem has limited scope as non-privileged users usually have no permissions to access SCSI device files. (bnc#1096728).
• CVE-2018-1068: A flaw was found in the implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory (bnc#1085107).
• CVE-2018-1130: Linux kernel was vulnerable to a null pointer dereference in dccp_write_xmit() function in net/dccp/output.c in that allowed a local user to cause a denial of service by a number of certain crafted system calls (bnc#1092904).
• CVE-2018-12233: In the ea_get function in fs/jfs/xattr.c a memory corruption bug in JFS could be triggered by calling setxattr twice with two different extended attribute names on the same file. This vulnerability can be triggered by an unprivileged user with the ability to create files and execute programs. A kmalloc call is incorrect, leading to slab-out-of-bounds in jfs_xattr (bnc#1097234).
• CVE-2018-13053: The alarm_timer_nsleep function in kernel/time/alarmtimer.c had an integer overflow via a large relative timeout because ktime_add_safe is not used (bnc#1099924).
• CVE-2018-13406: An integer overflow in the uvesafb_setcmap function in drivers/video/fbdev/uvesafb.c could result in local attackers being able to crash the kernel or potentially elevate privileges because kmalloc_array is not used (bnc#1098016 bnc#1100418).
• CVE-2018-3620: Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access via a terminal page fault and a side-channel analysis (bnc#1087081).
• CVE-2018-3646: Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis (bnc#1089343 bnc#1104365).
• CVE-2018-5803: An error in the '_sctp_make_chunk()' function (net/sctp/sm_make_chunk.c) when handling SCTP packets length could be exploited to cause a kernel crash (bnc#1083900).
• CVE-2018-5814: Multiple race condition errors when handling probe, disconnect, and rebind operations can be exploited to trigger a use-after-free condition or a NULL pointer dereference by sending multiple USB over IP packets (bnc#1096480).
• CVE-2018-7492: A NULL pointer dereference was found in the net/rds/rdma.c __rds_rdma_map() function allowed local attackers to cause a system panic and a denial-of-service, related to RDS_GET_MR and RDS_GET_MR_FOR_DEST (bnc#1082962).

The following non-security bugs were fixed:

• usb: add USB_DEVICE_INTERFACE_CLASS macro (bsc#1047487).
• usb: hub: fix non-SS hub-descriptor handling (bsc#1047487).
• usb: kobil_sct: fix non-atomic allocation in write path (bsc#1015828).
• usb: serial: ftdi_sio: fix latency-timer error handling (bsc#1037441).
• usb: serial: io_edgeport: fix NULL-deref at open (bsc#1015828).
• usb: serial: io_edgeport: fix possible sleep-in-atomic (bsc#1037441).
• usb: serial: keyspan_pda: fix modem-status error handling (bsc#1100132).
• usb: visor: Match I330 phone more precisely (bsc#1047487).
• cpu/hotplug: Add sysfs state…

It was discovered that memory present in the L1 data cache of an Intel CPU core may be exposed to a malicious process that is executing on the CPU core. This vulnerability is also known as L1 Terminal Fault (L1TF). A local attacker in a guest virtual machine could use this to expose sensitive information (memory from other guests or the host OS). (CVE-2018-3646)

It was discovered that memory present in the L1 data cache of an Intel CPU core may be exposed to a malicious process that is executing on the CPU core. This vulnerability is also known as L1 Terminal Fault (L1TF). A local attacker could use this to expose sensitive information (memory from the kernel or other processes). (CVE-2018-3620)

Juha-Matti Tilli discovered that the IP implementation in the Linux kernel performed algorithmically expensive operations in some situations when handling incoming packet fragments. A remote attacker could use this to cause a denial of service. (CVE-2018-5391)

USN-3740-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu 16.04 LTS.

It was discovered that memory present in the L1 data cache of an Intel CPU core may be exposed to a malicious process that is executing on the CPU core. This vulnerability is also known as L1 Terminal Fault (L1TF). A local attacker in a guest virtual machine could use this to expose sensitive information (memory from other guests or the host OS). (CVE-2018-3646)

It was discovered that memory present in the L1 data cache of an Intel CPU core may be exposed to a malicious process that is executing on the CPU core. This vulnerability is also known as L1 Terminal Fault (L1TF). A local attacker could use this to expose sensitive information (memory from the kernel or other processes). (CVE-2018-3620)

Juha-Matti Tilli discovered that the IP implementation in the Linux kernel performed algorithmically expensive operations in some situations when handling incoming packet fragments. A remote attacker could use this to cause a denial of service. (CVE-2018-5391)

It was discovered that memory present in the L1 data cache of an Intel CPU core may be exposed to a malicious process that is executing on the CPU core. This vulnerability is also known as L1 Terminal Fault (L1TF). A local attacker in a guest virtual machine could use this to expose sensitive information (memory from other guests or the host OS). (CVE-2018-3646)

It was discovered that memory present in the L1 data cache of an Intel CPU core may be exposed to a malicious process that is executing on the CPU core. This vulnerability is also known as L1 Terminal Fault (L1TF). A local attacker could use this to expose sensitive information (memory from the kernel or other processes). (CVE-2018-3620)

Juha-Matti Tilli discovered that the TCP implementation in the Linux kernel performed algorithmically expensive operations in some situations when handling incoming packets. A remote attacker could use this to cause a denial of service. (CVE-2018-5390)

Juha-Matti Tilli discovered that the IP implementation in the Linux kernel performed algorithmically expensive operations in some situations when handling incoming packet fragments. A remote attacker could use this to cause a denial of service. (CVE-2018-5391)

USN-3741-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS.

It was discovered that memory present in the L1 data cache of an Intel CPU core may be exposed to a malicious process that is executing on the CPU core. This vulnerability is also known as L1 Terminal Fault (L1TF). A local attacker in a guest virtual machine could use this to expose sensitive information (memory from other guests or the host OS). (CVE-2018-3646)

It was discovered that memory present in the L1 data cache of an Intel CPU core may be exposed to a malicious process that is executing on the CPU core. This vulnerability is also known as L1 Terminal Fault (L1TF). A local attacker could use this to expose sensitive information (memory from the kernel or other processes). (CVE-2018-3620)

Juha-Matti Tilli discovered that the TCP implementation in the Linux kernel performed algorithmically expensive operations in some situations when handling incoming packets. A remote attacker could use this to cause a denial of service. (CVE-2018-5390)

Juha-Matti Tilli discovered that the IP implementation in the Linux kernel performed algorithmically expensive operations in some situations when handling incoming packet fragments. A remote attacker could use this to cause a denial of service. (CVE-2018-5391)

It was discovered that memory present in the L1 data cache of an Intel CPU core may be exposed to a malicious process that is executing on the CPU core. This vulnerability is also known as L1 Terminal Fault (L1TF). A local attacker in a guest virtual machine could use this to expose sensitive information (memory from other guests or the host OS). (CVE-2018-3646)

It was discovered that memory present in the L1 data cache of an Intel CPU core may be exposed to a malicious process that is executing on the CPU core. This vulnerability is also known as L1 Terminal Fault (L1TF). A local attacker could use this to expose sensitive information (memory from the kernel or other processes). (CVE-2018-3620)

Andrey Konovalov discovered an out-of-bounds read in the POSIX timers subsystem in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or expose sensitive information. (CVE-2017-18344)

Juha-Matti Tilli discovered that the TCP implementation in the Linux kernel performed algorithmically expensive operations in some situations when handling incoming packets. A remote attacker could use this to cause a denial of service. (CVE-2018-5390)

Juha-Matti Tilli discovered that the IP implementation in the Linux kernel performed algorithmically expensive operations in some situations when handling incoming packet fragments. A remote attacker could use this to cause a denial of service. (CVE-2018-5391)